CVE WatchJul 24, 2026

CVE-2026-33825

Microsoft Defender Insufficient Granularity of Access Control Vulnerability

CVSS

7.8

High

EPSS

0.4%

p33

KEV

YES

Apr 22, 2026

Exploit Today

0-100

Published: Apr 14, 2026 · Last modified: Jul 24, 2026 · CWE-1220

EPSS · 30d

0.4%EPSS · 30 days6.7%

2026-09-172026-10-15

KEV catalog record

Product

Microsoft / Defender

Vulnerability

Microsoft Defender Insufficient Granularity of Access Control Vulnerability

Added to KEV

Apr 22, 2026

Remediate by

May 6, 2026

Known ransomware use

Yes

Summary description

Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825 ; https://nvd.nist.gov/vuln/detail/CVE-2026-33825

Technical description

Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-103509—

—

——0P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier and is fixed in 2026.4.3.8h CVE-2026-78433—

20.2%

——6Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker.1d CVE-2026-834997.8 HIG

21.7%

——7Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.2d CVE-2026-819697.8 HIG

21.7%

——7Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.2d CVE-2026-702187.8 HIG

23.0%

——7Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.2d CVE-2026-702165.5 MED

22.1%

——7Insufficient granularity of access control in Windows Mobile Device Management allows an authorized attacker to perform tampering locally.2d